A vulnerability was found in Comsenz Discuz! (CVE-2026-105146)

This vulnerability (CVE-2026-105146) affects Comsenz Discuz! versions X5.0-20260801, X5.0-20260820, and X5.0-20260910. It is a SQL injection flaw in the modmedalsubmit function of the Admin Medal Moderation component, specifically in the handling of the 'delete' argument. The vulnerability allows remote attackers to inject SQL commands, potentially impacting confidentiality, integrity, and availability. The vendor has not provided a response or patch. The CVSS 3.1 score is 4.7, indicating low severity. Exploit code has been publicly disclosed, but no confirmed active exploitation is known.

Successful exploitation could allow an attacker with high privileges to execute arbitrary SQL commands remotely, potentially leading to unauthorized data access, modification, or denial of service. The impact includes limited confidentiality, integrity, and availability consequences as indicated by the CVSS vector. However, exploitation requires high privileges (PR:H).

No official patch or remediation has been provided by the vendor. Since the vendor did not respond and no patch links are available, users should monitor vendor channels for updates. Until a fix is released, restricting access to the affected function and applying web application firewall rules to detect and block SQL injection attempts may help mitigate risk.